CVE-2026-123369 compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123369?
CVE-2026-123369 is a medium-severity vulnerability in tmatens compose-lint, published on 9 Nov 2026.
Official description
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.
Which versions are affected by CVE-2026-123369?
2 open source packages ship an affected version, including tmatens/compose-lint and compose-lint.
| Package | Affected | Fixed in |
|---|---|---|
tmatens/compose-lint GitHub Actions | From 0.2.0 | 0.31.0 |
compose-lint PyPI | All versions | 0.31.0 |
How do I fix CVE-2026-123369?
Upgrade tmatens/compose-lint to 0.31.0 or later.
Is CVE-2026-123369 being exploited?
There is no known exploitation of CVE-2026-123369 in the wild and no public exploit code.
Sources
Also known as GHSA-6f4g-xm8v-pgv6.